Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
364,627 total · sorted newest first- Jun 10, 2025
Malicious code in dplyr (npm)
1 compromised version
- Jun 10, 2025
Malware in dplyr
1 compromised version
- Jun 10, 2025
Malware in dependency-conftest
1 compromised version
- Jun 10, 2025
Malicious code in csvtool (npm)
1 compromised version
- Jun 10, 2025
Malware in csvtool
1 compromised version
- Jun 10, 2025
Malicious code in commons-fileupload (npm)
1 compromised version
- Jun 10, 2025
Malware in commons-fileupload
1 compromised version
- Jun 10, 2025
Malicious code in boost-static-assert (npm)
1 compromised version
- Jun 10, 2025
Malware in boost-static-assert
1 compromised version
- Jun 10, 2025
Malicious code in boost-iterator (npm)
1 compromised version
- Jun 10, 2025
Malware in boost-iterator
1 compromised version
- Jun 10, 2025
Malicious code in axios-browserify (npm)
1 compromised version
- Jun 10, 2025
Malware in axios-browserify
1 compromised version
- Jun 10, 2025
Malicious code in apple-appstore-server-library (npm)
1 compromised version
- Jun 10, 2025
Malware in apple-appstore-server-library
1 compromised version
- Jun 10, 2025
Malware in codex-cipher
1 compromised version
- Jun 9, 2025
Malicious code in react-server-dom-fb (npm)
- Jun 9, 2025
Malicious code in connectnodewebclient (npm)
1 compromised version
- Jun 9, 2025
Malicious code in frontegg-nuxt-example (npm)
1 compromised version
- Jun 9, 2025
Malicious code in flagd-playground (npm)
- Jun 9, 2025
Malicious code in npm-events-package (npm)
- Jun 9, 2025
Malicious code in my-headline (npm)
- Jun 9, 2025
Malicious code in third-party-dep-b (npm)
- Jun 9, 2025
Malicious code in third-party-dep-a (npm)
- Jun 9, 2025
Malicious code in next-pwa-template (npm)
1 compromised version
- Jun 9, 2025
Malicious code in keepachangelog-manager (npm)
- Jun 9, 2025
Malicious code in my-fun-tools (PyPI)
2 compromised versions
- Jun 9, 2025
Malicious code in robloxextra (PyPI)
7 compromised versions
- Jun 9, 2025
Malicious code in chimera-sandbox-extensions (PyPI)
1 compromised version
- Jun 9, 2025
Malicious code in 0x000asdqwe (npm)
1 compromised version
- Jun 9, 2025
Malicious code in zoro-gep-sdk (npm)
4 compromised versions
- Jun 8, 2025
Malicious code in base_sdk_const (npm)
1 compromised version
- Jun 8, 2025
Malicious code in payu-ui-v2 (npm)
1 compromised version
- Jun 7, 2025
Malicious code in win32con (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in tableausdk (PyPI)
3 compromised versions
- Jun 7, 2025
Malicious code in stubsoutagn (PyPI)
1 compromised version
- Jun 7, 2025
Malicious code in stubsout (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in spyderlib (PyPI)
1 compromised version
- Jun 7, 2025
Malicious code in pyximport (PyPI)
1 compromised version
- Jun 7, 2025
Malicious code in feature-gen-dt (PyPI)
1 compromised version
- Jun 7, 2025
Malicious code in atlasctf-21-prod-29 (PyPI)
4 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-21 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-20 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-19 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-18 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-17 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-16 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-15 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-14 (PyPI)
2 compromised versions
- Jun 7, 2025
Malicious code in atlasctf-21-prod-13 (PyPI)
2 compromised versions
Page 6289 of 7,293